diff --git a/.gitignore b/.gitignore index a65451b..723861c 100644 --- a/.gitignore +++ b/.gitignore @@ -212,4 +212,6 @@ cython_debug/ *secret* .vscode -.DS_Store \ No newline at end of file +.DS_Store +*.key +*.out \ No newline at end of file diff --git a/Taskfile.yml b/Taskfile.yml index f18c3ea..d25150a 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -1,21 +1,13 @@ version: 3 -includes: - tf: { taskfile: terraform, dir: terraform } - tasks: - dev: - - docker compose -f compose.dev.yml rm -fsv - - docker compose -f compose.dev.yml up --build --force-recreate --no-deps - - deploy:fast: ansible-playbook playbooks/fast.yml - deploy:slow: ansible-playbook playbooks/slow.yml - deploy:restore: ansible-playbook playbooks/restore.yml -e "restore_bucket={{.BUCKET}} restore_key={{.KEY}}" - + vault: ansible-vault edit vault.yml {{.CLI_ARGS}} + provision: ansible-playbook playbooks/provision.yml {{.CLI_ARGS}} + deploy: ansible-playbook playbooks/deploy.yml {{.CLI_ARGS}} + restore: ansible-playbook playbooks/restore.yml {{.CLI_ARGS}} + enter: - cmd: aws ssm start-session --target $INSTANCE_ID - env: - INSTANCE_ID: { sh: jq -r .instance_id.value < config/infrastructure.secret.json } - AWS_REGION: { sh: jq -r .aws_region < config/ansible.secret.json } - AWS_ACCESS_KEY_ID: { sh: jq -r .aws_access_key < config/ansible.secret.json } - AWS_SECRET_ACCESS_KEY: { sh: jq -r .aws_secret_key < config/ansible.secret.json } + cmd: ssh -i {{.KEY}} -p 2222 root@{{.IP}} + vars: + KEY: { sh: ansible-vault view vault.yml | yq -r ".secret.private_ssh_key_path" } + IP: { sh: cat dist/terraform_outputs.yml | jq -r ".server_ip.value" } \ No newline at end of file diff --git a/ansible.cfg b/ansible.cfg index 32ad899..63c126b 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -1,6 +1,13 @@ [defaults] callbacks_enabled = profile_tasks localhost_warning = False +vault_password_file = vault.key +interpreter_python = /usr/bin/python3.11 [inventory] inventory_unparsed_warning = False + +[ssh_connection] +ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes -o IdentityAgent=none +pipelining = True +retries = 2 \ No newline at end of file diff --git a/gitea/Dockerfile b/gitea/Dockerfile index 17a78c1..0d7ffea 100644 --- a/gitea/Dockerfile +++ b/gitea/Dockerfile @@ -4,3 +4,4 @@ ADD --chown=git:git config /etc/gitea ADD --chown=git:git custom /etc/gitea-custom ENV GITEA_CUSTOM=/etc/gitea-custom +ENV BUCKET_KEY="" diff --git a/gitea/Dockerfile.dev b/gitea/Dockerfile.dev deleted file mode 100644 index 7f6b027..0000000 --- a/gitea/Dockerfile.dev +++ /dev/null @@ -1,13 +0,0 @@ -FROM gitea/gitea:latest-rootless - -ADD --chown=git:git config /etc/gitea -ADD --chown=git:git custom /etc/gitea-custom - -ENV GITEA_CUSTOM=/etc/gitea-custom - -RUN rm /etc/gitea/app.ini -RUN mv /etc/gitea/dev.app.ini /etc/gitea/app.ini - -WORKDIR /etc/gitea-custom - -RUN gitea cert --host localhost --ca \ No newline at end of file diff --git a/gitea/config/app.ini b/gitea/config/app.ini index 8fb2a66..9648ad6 100644 --- a/gitea/config/app.ini +++ b/gitea/config/app.ini @@ -4,7 +4,7 @@ RUN_MODE = prod WORK_PATH = /var/lib/gitea [ui] -DEFAULT_THEME = gitea-dark +DEFAULT_THEME = gitea-light [repository] ROOT = /var/lib/gitea/git/repositories @@ -24,16 +24,12 @@ DISABLE_SSH = false START_SSH_SERVER = true SSH_PORT = 22 SSH_LISTEN_PORT = 22 -# SSH_DOMAIN = %(FULL_DOMAIN)s BUILTIN_SSH_SERVER_USER = git PROTOCOL=https ENABLE_ACME=true ACME_ACCEPTTOS=true ACME_DIRECTORY=https -# ACME_EMAIL=%(EMAIL)s -# DOMAIN = %(FULL_DOMAIN)s -# ROOT_URL = %(ROOT_URL)s HTTP_PORT = 443 [database] @@ -97,7 +93,5 @@ DEFAULT_TRUST_MODEL = committer [storage] STORAGE_TYPE = minio -MINIO_ENDPOINT = s3.us-east-1.amazonaws.com -MINIO_BUCKET = myrica-faya MINIO_USE_SSL = true -MINIO_INSECURE_SKIP_VERIFY = false \ No newline at end of file +MINIO_INSECURE_SKIP_VERIFY = false diff --git a/gitea/config/dev.app.ini b/gitea/config/dev.app.ini deleted file mode 100644 index f17a670..0000000 --- a/gitea/config/dev.app.ini +++ /dev/null @@ -1,106 +0,0 @@ -APP_NAME = """Max's Code""" -RUN_USER = git -RUN_MODE = prod -WORK_PATH = /var/lib/gitea - -[ui] -DEFAULT_THEME = gitea-dark - -[repository] -ROOT = /var/lib/gitea/git/repositories - -[repository.local] -LOCAL_COPY_PATH = /tmp/gitea/local-repo - -[repository.upload] -TEMP_PATH = /tmp/gitea/uploads - -[server] -APP_DATA_PATH = /var/lib/gitea -LFS_START_SERVER = true -OFFLINE_MODE = true -LFS_JWT_SECRET = x-----------------------------------------x - -DISABLE_SSH = false -START_SSH_SERVER = true -SSH_PORT = 2222 -SSH_LISTEN_PORT = 2222 -SSH_DOMAIN = localhost -BUILTIN_SSH_SERVER_USER = git - -PROTOCOL = https -ROOT_URL = https://localhost:443/ -DOMAIN = localhost -HTTP_PORT = 443 -CERT_FILE = /etc/gitea-custom/cert.pem -KEY_FILE = /etc/gitea-custom/key.pem - -[database] -DB_TYPE = sqlite3 - -[session] -PROVIDER_CONFIG = /var/lib/gitea/data/sessions -PROVIDER = file - -[picture] -AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars -REPOSITORY_AVATAR_UPLOAD_PATH = /var/lib/gitea/data/repo-avatars - -[attachment] -PATH = /var/lib/gitea/data/attachments - -[log] -ROOT_PATH = /var/lib/gitea/data/log -MODE = console -LEVEL = info - -[security] -INSTALL_LOCK = true -SECRET_KEY = -REVERSE_PROXY_LIMIT = 1 -REVERSE_PROXY_TRUSTED_PROXIES = * -PASSWORD_HASH_ALGO = pbkdf2 -INTERNAL_TOKEN = x-----------------------------------------x - -[service] -DISABLE_REGISTRATION = true -REQUIRE_SIGNIN_VIEW = false -REGISTER_EMAIL_CONFIRM = false -ENABLE_NOTIFY_MAIL = false -ALLOW_ONLY_EXTERNAL_REGISTRATION = false -ENABLE_CAPTCHA = false -DEFAULT_KEEP_EMAIL_PRIVATE = false -DEFAULT_ALLOW_CREATE_ORGANIZATION = true -DEFAULT_ENABLE_TIMETRACKING = true -NO_REPLY_ADDRESS = noreply - -[lfs] -PATH = /var/lib/gitea/git/lfs - -[mailer] -ENABLED = false - -[openid] -ENABLE_OPENID_SIGNIN = false -ENABLE_OPENID_SIGNUP = false - -[cron.update_checker] -ENABLED = false - -[repository.pull-request] -DEFAULT_MERGE_STYLE = merge - -[repository.signing] -DEFAULT_TRUST_MODEL = committer - -[oauth2] -JWT_SECRET = x-----------------------------------------x - -[storage] -STORAGE_TYPE = minio -MINIO_ENDPOINT = localstack:4566 -MINIO_ACCESS_KEY_ID = test -MINIO_SECRET_ACCESS_KEY = test -MINIO_BUCKET = storage -MINIO_USE_SSL = false -MINIO_INSECURE_SKIP_VERIFY = true \ No newline at end of file diff --git a/playbooks/deploy.yml b/playbooks/deploy.yml new file mode 100644 index 0000000..9b84b48 --- /dev/null +++ b/playbooks/deploy.yml @@ -0,0 +1,200 @@ +- name: Set up for fresh host. + gather_facts: false + hosts: localhost + vars_files: + - ../vault.yml + - ../dist/terraform_outputs.yml + tasks: + - name: Add remote host. + ansible.builtin.add_host: + name: server_fresh + ansible_ssh_host: "{{ server_ip.value }}" + ansible_user: root + ansible_port: 22 + ansible_private_key_file: "{{ secret.private_ssh_key_path }}" + +- name: Switch port to 2222. + hosts: server_fresh + ignore_unreachable: true + gather_facts: false + tasks: + - name: Update SSH port. + ansible.builtin.lineinfile: + dest: "/etc/ssh/sshd_config" + regexp: "^Port" + line: "Port 2222" + + - name: Restart service. + ansible.builtin.service: + name: ssh + state: restarted + +- name: Set up real host. + gather_facts: false + hosts: localhost + tags: + - deploy + vars_files: + - ../vault.yml + - ../dist/terraform_outputs.yml + tasks: + - name: Add remote host. + ansible.builtin.add_host: + name: server + ansible_ssh_host: "{{ server_ip.value }}" + ansible_user: root + ansible_port: 2222 + ansible_private_key_file: "{{ secret.private_ssh_key_path }}" + +- name: Install Docker. + gather_facts: true + hosts: server + vars_files: + - ../vault.yml + - ../dist/terraform_outputs.yml + tasks: + - name: Install PIP. + ansible.builtin.apt: + name: + - python3-pip + state: present + + - name: Install needed packages. + ansible.builtin.pip: + name: + - botocore + - boto3 + - packaging + state: present + break_system_packages: true + + - name: Download Docker repository key. + ansible.builtin.apt_key: + url: https://download.docker.com/linux/debian/gpg + state: present + + - name: Download Docker repository. + ansible.builtin.apt_repository: + repo: "deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable" + state: present + + - name: Remove bad packages. + ansible.builtin.apt: + state: absent + package: + - docker.io + - docker-doc + - docker-compose + - podman-docker + - containerd + - runc + + - name: Download Docker dependencies. + ansible.builtin.apt: + state: present + package: + - ca-certificates + - curl + + - name: Download Docker packages. + ansible.builtin.apt: + state: present + update_cache: true + package: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-buildx-plugin + - docker-compose-plugin + +- name: Deploy artifact to instance. + hosts: server + tags: + - deploy + gather_facts: false + vars_files: + - ../variables.yml + - ../vault.yml + - ../dist/terraform_outputs.yml + tasks: + - name: Copy gitea folder. + ansible.builtin.copy: + src: ../gitea/ + dest: /root/gitea/ + mode: preserve + + - name: Build image. + community.docker.docker_image_build: + name: "{{ variables.image_name }}" + path: /root/gitea + nocache: true + rebuild: always + pull: true + + - name: Create data directory. + ansible.builtin.file: + path: /root/data + state: directory + mode: '0777' + + - name: Run image. + community.docker.docker_container: + name: server + image: "{{ variables.image_name }}" + state: started + recreate: true + restart_policy: unless-stopped + memory: 425m + memory_swap: 900m + ports: [80:80, 443:443, "22:22"] + env: + # Secrets. + GITEA__security__INTERNAL_TOKEN: "{{ secret.internal }}" + GITEA__server__LFS_JWT_SECRET: "{{ secret.lfs }}" + GITEA__oauth2__JWT_SECRET: "{{ secret.jwt }}" + GITEA__server__ACME_EMAIL: "acme@maximhutz.me" + GITEA__server__SSH_DOMAIN: "{{ server_fqdn.value }}" + GITEA__server__DOMAIN: "{{ server_fqdn.value }}" + GITEA__server__ROOT_URL: "https://{{ server_fqdn.value }}/" + + # General S3 storage information. + GITEA__storage__MINIO_BUCKET: "{{ secret.bucket.name }}" + GITEA__storage__MINIO_ENDPOINT: "{{ secret.bucket.endpoint }}" + GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}" + GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}" + + # Set storage to specific S3 bucket path. + GITEA__storage_0x2E_attachments__MINIO_BASE_PATH: "{{ secret.storage.key }}/attachments" + GITEA__storage_0x2E_lfs__MINIO_BASE_PATH: "{{ secret.storage.key }}/lfs" + GITEA__storage_0x2E_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/avatars" + GITEA__storage_0x2E_repo_0X2D_archive___MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-archive" + GITEA__storage_0x2E_repo_0X2D_avatars__MINIO_BASE_PATH: "{{ secret.storage.key }}/repo-avatars" + GITEA__storage_0x2E_packages__MINIO_BASE_PATH: "{{ secret.storage.key }}/packages" + GITEA__storage_0x2E_actions_log__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_log" + GITEA__storage_0x2E_actions_artifacts__MINIO_BASE_PATH: "{{ secret.storage.key }}/actions_artifacts" + + labels: + docker-volume-backup.stop-during-backup: "true" + volumes: + - /root/data:/var/lib/gitea + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + + - name: Run backup. + community.docker.docker_container: + name: backup + image: offen/docker-volume-backup:v2 + state: started + recreate: true + restart_policy: unless-stopped + volumes: + - /root/data:/backup/my-app-backup:ro + - /var/run/docker.sock:/var/run/docker.sock:ro + env: + AWS_S3_BUCKET_NAME: "{{ secret.bucket.name }}" + AWS_S3_PATH: "{{ secret.backup.key }}" + AWS_REGION: "{{ secret.bucket.region }}" + AWS_ACCESS_KEY_ID: "{{ secret.bucket.access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ secret.bucket.secret_key }}" + AWS_ENDPOINT: "{{ secret.bucket.endpoint }}" + BACKUP_CRON_EXPRESSION: "0 0 * * *" diff --git a/playbooks/fast.yml b/playbooks/fast.yml deleted file mode 100644 index cbc46f7..0000000 --- a/playbooks/fast.yml +++ /dev/null @@ -1,91 +0,0 @@ -- name: Make build artifact. - hosts: localhost - vars_files: - - ../config/ansible.secret.json - - ../config/infrastructure.secret.json - gather_facts: false - tasks: - - name: Log into Docker. - community.docker.docker_login: - registry_url: '{{ full_domain.value }}' - username: '{{ username }}' - password: '{{ api_key }}' - reauthorize: true - - - name: Build image. - community.docker.docker_image_build: - name: "{{ full_domain.value }}/{{ image_name }}:latest" - path: ../gitea - nocache: true - rebuild: always - pull: true - outputs: [{ type: image, push: true }] - platform: - - linux/amd64 - - linux/arm64/v8 - - - name: Log out of Docker. - community.docker.docker_login: - state: absent - -- name: Deploy artifact to instance. - hosts: localhost - become: true - gather_facts: false - vars_files: - - ../config/ansible.secret.json - - ../config/infrastructure.secret.json - vars: - ansible_connection: aws_ssm - ansible_aws_ssm_plugin: "{{ ssm_plugin }}" - ansible_aws_ssm_bucket_name: "{{ image_bucket }}" - ansible_aws_ssm_instance_id: "{{ instance_id.value }}" - ansible_python_interpreter: /usr/bin/python3 - ansible_aws_ssm_region: "{{ aws_region }}" - ansible_aws_ssm_access_key_id: "{{ aws_access_key }}" - ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}" - tasks: - - name: Run image. - community.docker.docker_container: - name: server - image: "{{ full_domain.value }}/{{ image_name }}:latest" - state: started - recreate: true - restart_policy: unless-stopped - memory: 425m - memory_swap: 900m - ports: [80:80, 2222:2222, 443:443, "22:22"] - env: - GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}" - GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}" - GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}" - GITEA__server__ACME_EMAIL: "{{ email }}" - GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}" - GITEA__server__DOMAIN: "{{ full_domain.value }}" - GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/" - GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}" - GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}" - labels: - docker-volume-backup.stop-during-backup: "true" - volumes: - - /home/ssm-user/data:/var/lib/gitea - - /etc/timezone:/etc/timezone:ro - - /etc/localtime:/etc/localtime:ro - - - name: Run backup. - community.docker.docker_container: - name: backup - image: offen/docker-volume-backup:v2 - state: started - recreate: true - restart_policy: unless-stopped - volumes: - - /home/ssm-user/data:/backup/my-app-backup:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - env: - AWS_S3_BUCKET_NAME: "{{ boot_bucket }}" - AWS_S3_PATH: "{{ boot_key }}" - AWS_REGION: "{{ boot_region.value }}" - AWS_ACCESS_KEY_ID: "{{ boot_id.value }}" - AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}" - BACKUP_CRON_EXPRESSION: "0 0 * * *" diff --git a/playbooks/provision.yml b/playbooks/provision.yml new file mode 100644 index 0000000..42525b0 --- /dev/null +++ b/playbooks/provision.yml @@ -0,0 +1,38 @@ +- name: Deploy terraform infrastructure. + hosts: localhost + gather_facts: false + vars_files: + - ../vault.yml + tasks: + - name: Reconfigure and plan. + community.general.terraform: + project_path: '../terraform' + state: "planned" + plan_file: plan.out + # init_reconfigure: true + backend_config: "{{ terraform.backend }}" + variables: "{{ terraform.variables }}" + complex_vars: true + + - name: Apply. + community.general.terraform: + project_path: '../terraform' + state: "present" + plan_file: plan.out + backend_config: "{{ terraform.backend }}" + variables: "{{ terraform.variables }}" + complex_vars: true + register: terraform_apply + + - name: Create secret directory. + ansible.builtin.file: + path: ../dist + recurse: true + mode: "0755" + state: directory + + - name: Send outputs to file. + ansible.builtin.copy: + content: "{{ terraform_apply.outputs }}" + dest: ../dist/terraform_outputs.yml + mode: '0755' diff --git a/playbooks/restore.yml b/playbooks/restore.yml index e0a848f..a7f1ab2 100644 --- a/playbooks/restore.yml +++ b/playbooks/restore.yml @@ -1,19 +1,25 @@ -- name: Deploy artifact to instance. +- name: Set up real host. + gather_facts: false hosts: localhost + vars_files: + - ../vault.yml + - ../dist/terraform_outputs.yml + tasks: + - name: Add remote host. + ansible.builtin.add_host: + name: server + ansible_ssh_host: "{{ server_ip.value }}" + ansible_user: root + ansible_port: 2222 + ansible_private_key_file: "{{ secret.private_ssh_key_path }}" + +- name: Deploy artifact to instance. + hosts: server become: true gather_facts: false vars_files: - - ../config/ansible.secret.json - - ../config/infrastructure.secret.json - vars: - ansible_connection: aws_ssm - ansible_python_interpreter: /usr/bin/python3 - ansible_aws_ssm_plugin: "{{ ssm_plugin }}" - ansible_aws_ssm_bucket_name: "{{ image_bucket }}" - ansible_aws_ssm_instance_id: "{{ instance_id.value }}" - ansible_aws_ssm_region: "{{ aws_region }}" - ansible_aws_ssm_access_key_id: "{{ aws_access_key }}" - ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}" + - ../vault.yml + - ../dist/terraform_outputs.yml tasks: - name: Stop server. community.docker.docker_container: @@ -22,38 +28,38 @@ loop: [server, backup] - name: Copy backup from S3. - environment: - region: "{{ boot_region.value }}" - access_key: "{{ boot_id.value }}" - secret_key: "{{ boot_secret.value }}" amazon.aws.s3_object: - bucket: "{{ restore_bucket | mandatory(msg='You must specify the bucket of the data.') }}" - object: "{{ restore_key | mandatory(msg='You must specify the key of the data.') }}" - dest: /home/ssm-user/backup.tar.gz + bucket: "{{ secret.restore.bucket | mandatory(msg='You must specify the bucket of the data.') }}" + object: "{{ secret.restore.key | mandatory(msg='You must specify the key of the data.') }}" + dest: /root/snapshot.tar.gz mode: get + region: "{{ secret.restore.region }}" + access_key: "{{ secret.restore.access_key }}" + secret_key: "{{ secret.restore.secret_key }}" + ignore_nonexistent_bucket: true - name: Ensure backup directory exists. ansible.builtin.file: - path: /home/ssm-user/backup + path: /root/restore state: directory mode: '0777' - name: Extract backup. ansible.builtin.unarchive: - src: /home/ssm-user/backup.tar.gz - dest: /home/ssm-user/backup + src: /root/snapshot.tar.gz + dest: /root/restore remote_src: true - name: Move backup files to data folder. ansible.builtin.copy: remote_src: true - src: /home/ssm-user/backup/backup/my-app-backup/ - dest: /home/ssm-user/data/ + src: /root/restore/backup/my-app-backup/ + dest: /root/data/ mode: '0777' - name: Update permissions. ansible.builtin.file: - path: /home/ssm-user/data + path: /root/data recurse: true mode: '0777' owner: 1000 diff --git a/playbooks/slow.yml b/playbooks/slow.yml deleted file mode 100644 index f851fb0..0000000 --- a/playbooks/slow.yml +++ /dev/null @@ -1,121 +0,0 @@ -- name: Make build artifact. - hosts: localhost - vars_files: ../config/ansible.secret.json - gather_facts: false - tasks: - - name: Build image. - community.docker.docker_image_build: - name: "{{ image_name }}" - path: ../gitea - nocache: true - rebuild: always - pull: true - - - name: Push image to archive. - community.docker.docker_image: - name: "{{ image_name }}" - archive_path: ../dist/image.tar - source: local - - - name: Compress archive to artifact. - register: compress_image - community.general.archive: - path: ../dist/image.tar - dest: ../dist/image.tar.xz - format: xz - mode: "0644" - - - name: Push artifact to S3. - amazon.aws.s3_object: - bucket: "{{ image_bucket }}" - object: "{{ image_key }}" - src: ../dist/image.tar.xz - mode: put - - region: "{{ aws_region }}" - access_key: "{{ aws_access_key }}" - secret_key: "{{ aws_secret_key }}" - -- name: Deploy artifact to instance. - hosts: localhost - become: true - gather_facts: false - vars_files: - - ../config/ansible.secret.json - - ../config/infrastructure.secret.json - vars: - ansible_connection: aws_ssm - ansible_python_interpreter: /usr/bin/python3 - ansible_aws_ssm_plugin: "{{ ssm_plugin }}" - ansible_aws_ssm_bucket_name: "{{ image_bucket }}" - ansible_aws_ssm_instance_id: "{{ instance_id.value }}" - ansible_aws_ssm_region: "{{ aws_region }}" - ansible_aws_ssm_access_key_id: "{{ aws_access_key }}" - ansible_aws_ssm_secret_access_key: "{{ aws_secret_key }}" - tasks: - - name: Fetch image. - amazon.aws.s3_object: - mode: get - bucket: "{{ image_bucket }}" - object: "{{ image_key }}" - dest: /root/image.tar.gz - - region: "{{ aws_region }}" - access_key: "{{ aws_access_key }}" - secret_key: "{{ aws_secret_key }}" - - - name: Create data directory. - ansible.builtin.file: - path: /home/ssm-user/data - state: directory - mode: '0777' - - - name: Load image. - community.docker.docker_image_load: - path: /root/image.tar.gz - register: image - - - name: Run image. - community.docker.docker_container: - name: server - image: "{{ image.image_names[0] }}" - state: started - recreate: true - restart_policy: unless-stopped - memory: 425m - memory_swap: 900m - ports: [80:80, 2222:2222, 443:443, "22:22"] - env: - GITEA__security__INTERNAL_TOKEN: "{{ internal_secret }}" - GITEA__server__LFS_JWT_SECRET: "{{ lfs_secret }}" - GITEA__oauth2__JWT_SECRET: "{{ jwt_secret }}" - GITEA__server__ACME_EMAIL: "{{ email }}" - GITEA__server__SSH_DOMAIN: "{{ full_domain.value }}" - GITEA__server__DOMAIN: "{{ full_domain.value }}" - GITEA__server__ROOT_URL: "https://{{ full_domain.value }}/" - GITEA__storage__MINIO_ACCESS_KEY_ID: "{{ minio_access_key }}" - GITEA__storage__MINIO_SECRET_ACCESS_KEY: "{{ minio_secret_key }}" - labels: - docker-volume-backup.stop-during-backup: "true" - volumes: - - /home/ssm-user/data:/var/lib/gitea - - /etc/timezone:/etc/timezone:ro - - /etc/localtime:/etc/localtime:ro - - - name: Run backup. - community.docker.docker_container: - name: backup - image: offen/docker-volume-backup:v2 - state: started - recreate: true - restart_policy: unless-stopped - volumes: - - /home/ssm-user/data:/backup/my-app-backup:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - env: - AWS_S3_BUCKET_NAME: "{{ boot_bucket }}" - AWS_S3_PATH: "{{ boot_key }}" - AWS_REGION: "{{ boot_region.value }}" - AWS_ACCESS_KEY_ID: "{{ boot_id.value }}" - AWS_SECRET_ACCESS_KEY: "{{ boot_secret.value }}" - BACKUP_CRON_EXPRESSION: "0 0 * * *" diff --git a/requirements.txt b/requirements.txt index 30ce1b7..f1062ee 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14,6 +14,7 @@ charset-normalizer==3.4.1 click==8.1.8 cryptography==44.0.0 filelock==3.16.1 +go-task-bin==3.44.1 idna==3.10 importlib_metadata==8.5.0 Jinja2==3.1.5 diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index 8b9ee2c..10fc2d6 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -2,23 +2,45 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/aws" { - version = "5.83.1" + version = "6.12.0" hashes = [ - "h1:Yy3K7R7881H72rQDzG6qjZVkrWA6DGJzfE21TionY7w=", - "zh:0313253c78f195973752c4d1f62bfdd345a9c99c1bc7a612a8c1f1e27d51e49e", - "zh:108523f3e9ebc93f7d900c51681f6edbd3f3a56b8a62b0afc31d8214892f91e0", - "zh:175b9bf2a00bea6ac1c73796ad77b0e00dcbbde166235017c49377d7763861d8", - "zh:1c8bf55b8548bbad683cd6d7bdb03e8840a00b2422dc1529ffb9892820657130", - "zh:22338f09bae62d5ff646de00182417f992548da534fee7d98c5d0136d4bd5d7a", - "zh:92de1107ec43de60612be5f6255616f16a9cf82d88df1af1c0471b81f3a82c16", + "h1:8u90EMle+I3Auh4f/LPP6fEfRsAF6xCFnUZF4b7ngEs=", + "zh:054bcbf13c6ac9ddd2247876f82f9b56493e2f71d8c88baeec142386a395165d", + "zh:195489f16ad5621db2cec80be997d33060462a3b8d442c890bef3eceba34fa4d", + "zh:3461ef14904ab7de246296e44d24c042f3190e6bead3d7ce1d9fda63dcb0f047", + "zh:44517a0035996431e4127f45db5a84f53ce80730eae35629eda3101709df1e5c", + "zh:4b0374abaa6b9a9debed563380cc944873e4f30771dd1da7b9e812a49bf485e3", + "zh:531468b99465bd98a89a4ce2f1a30168dfadf6edb57f7836df8a977a2c4f9804", + "zh:6a95ed7b4852174aa748d3412bff3d45e4d7420d12659f981c3d9f4a1a59a35f", + "zh:88c2d21af1e64eed4a13dbb85590c66a519f3ecc54b72875d4bb6326f3ef84e7", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:9c7bfb7afea330e6d90e1466125a8cba3db1ed4043c5da52f737459c89290a6e", - "zh:ba59b374d477e5610674b70f5abfe0408e8f809390347372751384151440d3d0", - "zh:bd1c433966002f586d63cb1e3e16326991f238bc6beeb2352be36ec651917b0b", - "zh:ca2b4d1d02651c15261fffa4b142e45def9a22c6069353f0f663fd2046e268f8", - "zh:d8ed98c748f7a3f1a72277cfee9afe346aca39ab319d17402277852551d8f14a", - "zh:ed3d8bc89de5f35f3c5f4802ff7c749fda2e2be267f9af4a850694f099960a72", - "zh:f698732a4391c3f4d7079b4aaa52389da2a460cac5eed438ed688f147d603689", - "zh:f9f51b17f2978394954e9f6ab9ef293b8e11f1443117294ccf87f7f8212b3439", + "zh:a8b648470bb5df098e56b1ec5c6a39e0bbb7b496b23a19ea9f494bf48d4a122a", + "zh:b23fb13efdb527677db546bc92aeb2bdf64ff3f480188841f2bfdfa7d3d907c1", + "zh:be5858a1951ae5f5a9c388949c3e3c66a3375f684fb79b06b1d1db7a9703b18e", + "zh:c368e03a7c922493daf4c7348faafc45f455225815ef218b5491c46cea5f76b7", + "zh:e31e75d5d19b8ac08aa01be7e78207966e1faa3b82ed9fe3acfdc2d806be924c", + "zh:ea84182343b5fd9252a6fae41e844eed4fdc3311473a753b09f06e49ec0e7853", + ] +} + +provider "registry.terraform.io/hetznercloud/hcloud" { + version = "1.52.0" + constraints = "~> 1.45" + hashes = [ + "h1:LTjrLuC+4F1Kv4TxS9e7LVVkG8/S4QQ7X4ORblvKTbc=", + "zh:1e9bb6b6a2ea5f441638dbae2d60fbe04ff455f58a18c740b8b7913e2197d875", + "zh:29c122e404ba331cfbadacc7f1294de5a31c9dfd60bdfe3e1b402271fc8e419c", + "zh:2bd0ae2f0bb9f16b7753f59a08e57ac7230f9c471278d7882f81406b9426c8c7", + "zh:4383206971873f6b5d81580a9a36e0158924f5816ebb6206b0cf2430e4e6a609", + "zh:47e2ca1cfa18500e4952ab51dc357a0450d00a92da9ea03e452f1f3efe6bbf75", + "zh:8e9fe90e3cea29bb7892b64da737642fc22b0106402df76c228a3cbe99663278", + "zh:a2d69350a69c471ddb63bcc74e105e585319a0fc0f4d1b7f70569f6d2ece5824", + "zh:a97abcc254e21c294e2d6b0fc9068acfd63614b097dda365f1c56ea8b0fd5f6b", + "zh:aba8d72d4fe2e89c922d5446d329e5c23d00b28227b4666e6486ba18ea2ec278", + "zh:ad36c333978c2d9e4bc43dcadcbff42fe771a8c5ef53d028bcacec8287bf78a7", + "zh:cdb1e6903b9d2f0ad8845d4eb390fbe724ee2435fb045baeab38d4319e637682", + "zh:df77b08757f3f36b8aadb33d73362320174047044414325c56a87983f48b5186", + "zh:e07513d5ad387247092b5ae1c87e21a387fc51873b3f38eee616187e38b090a7", + "zh:e2be02bdc59343ff4b9e26c3b93db7680aaf3e6ed13c8c4c4b144c74c2689915", ] } diff --git a/terraform/Taskfile.yml b/terraform/Taskfile.yml deleted file mode 100644 index 4f51aec..0000000 --- a/terraform/Taskfile.yml +++ /dev/null @@ -1,18 +0,0 @@ -version: 3 -silent: true - -vars: - BACKEND: ../config/backend.secret.json - VARIABLES: ../config/variables.secret.json - OUTPUT: ../config/infrastructure.secret.json - -tasks: - init: terraform init -backend-config={{.BACKEND}} - plan: terraform plan -var-file={{.VARIABLES}} - destroy: terraform destroy - format: terraform fmt -recursive - out: terraform output -json > {{.OUTPUT}} - apply: - - terraform apply -var-file={{.VARIABLES}} - - task: out - import: terraform import -var-file={{.VARIABLES}} {{.CLI_ARGS}} \ No newline at end of file diff --git a/terraform/iam.tf b/terraform/iam.tf deleted file mode 100644 index eba76dc..0000000 --- a/terraform/iam.tf +++ /dev/null @@ -1,31 +0,0 @@ -data "aws_s3_bucket" "storage_bucket" { - bucket = var.boot_bucket -} - -data "aws_iam_policy_document" "boot" { - statement { - effect = "Allow" - actions = ["s3:*", "s3-object-lambda:*"] - resources = [ - "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}", - "${data.aws_s3_bucket.storage_bucket.arn}/${var.boot_key}/*", - ] - } -} - -resource "aws_iam_policy" "boot" { - name = "${var.boot_role}Policy" - description = "The policy that manages the Gitea Boot." - - policy = data.aws_iam_policy_document.boot.json -} - -module "boot_user" { - source = "terraform-aws-modules/iam/aws//modules/iam-user" - version = "5.52.2" - - create_iam_user_login_profile = false - name = "${var.boot_role}User" - password_reset_required = false - policy_arns = [aws_iam_policy.boot.arn] -} diff --git a/terraform/main.tf b/terraform/main.tf index 69704ec..4f4543f 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -1,43 +1,62 @@ -# An elastic IP, so if the reverse proxy is modified, the route tables won't. -resource "aws_eip" "public" { - instance = aws_instance.this.id - domain = "vpc" +resource "hcloud_primary_ip" "public_ip" { + name = "repository-public-ip" + datacenter = local.datacenter + type = "ipv4" + assignee_type = "server" + auto_delete = false } -# An instance profile for access via AWS SSM. -resource "aws_iam_instance_profile" "ssm" { - name = "SSMInstanceProfile" - role = "AmazonSSMRoleForInstancesQuickSetup" +resource "hcloud_ssh_key" "ssh_key" { + name = "repository-ssh-key" + public_key = file(var.public_ssh_key_path) } -# The Gitea instance. -resource "aws_instance" "this" { - # ami = data.aws_ami.amazon-linux-2.id - ami = "ami-0adec96dc0cdc7bca" - instance_type = "t4g.nano" - subnet_id = module.vpc.public_subnets[0] +resource "hcloud_server" "server_instance" { + name = "repository-server" + image = local.server_image + server_type = local.server_type + datacenter = local.datacenter + ssh_keys = [hcloud_ssh_key.ssh_key.id] - user_data = file("install.sh") - user_data_replace_on_change = true - - iam_instance_profile = aws_iam_instance_profile.ssm.name - vpc_security_group_ids = [aws_security_group.public_access.id] - - metadata_options { - http_tokens = "required" - } - - root_block_device { - volume_type = "gp3" - volume_size = 8 - } - - tags = { - Name = "Codebase: Gitea" + public_net { + ipv4_enabled = true + ipv4 = hcloud_primary_ip.public_ip.id + ipv6_enabled = false } } -resource "aws_ec2_instance_state" "this" { - instance_id = aws_instance.this.id - state = "running" +resource "hcloud_firewall" "server_firewall" { + name = "repository-server-firewall" + + # Allow ICMP. + rule { + direction = "in" + protocol = "icmp" + source_ips = ["0.0.0.0/0", "::/0"] + } + + # Allow all out. + rule { + direction = "out" + protocol = "tcp" + port = "any" + destination_ips = ["0.0.0.0/0", "::/0"] + } + + # Poke holes for applications, and SSH. + dynamic "rule" { + for_each = ["80", "443", "22", "2222"] + + content { + direction = "in" + protocol = "tcp" + port = rule.value + source_ips = ["0.0.0.0/0", "::/0"] + } + } +} + +resource "hcloud_firewall_attachment" "server_fw_attachment" { + firewall_id = hcloud_firewall.server_firewall.id + server_ids = [hcloud_server.server_instance.id] } diff --git a/terraform/network.tf b/terraform/network.tf deleted file mode 100644 index a93837d..0000000 --- a/terraform/network.tf +++ /dev/null @@ -1,55 +0,0 @@ -locals { - # The IP block for the VPC. - vpc_cidr = "10.0.0.0/16" -} - -data "aws_availability_zones" "all" {} - -# The main VPC. -module "vpc" { - source = "terraform-aws-modules/vpc/aws" - - name = "Main" - cidr = local.vpc_cidr - - azs = [data.aws_availability_zones.all.names[0]] - private_subnets = [cidrsubnet(local.vpc_cidr, 8, 0)] - public_subnets = [cidrsubnet(local.vpc_cidr, 8, 4)] - - private_subnet_tags = { SubnetOf = "Main", SubnetType = "Private" } - public_subnet_tags = { SubnetOf = "Main", SubnetType = "Public" } - - map_public_ip_on_launch = true - enable_dns_hostnames = true - enable_dns_support = true - - private_route_table_tags = { TableOf = "Main", TableType = "Public" } -} - -# Only allow HTTP(s) and SSH traffic. Allow full access to internet. -resource "aws_security_group" "public_access" { - vpc_id = module.vpc.vpc_id - tags = { GroupOf = "Main", GroupType = "Public" } -} - -resource "aws_vpc_security_group_ingress_rule" "ingress" { - for_each = toset(["80", "443", "22", "2222", "81", "8080", "4321", "1234"]) - - security_group_id = aws_security_group.public_access.id - - from_port = each.value - to_port = each.value - ip_protocol = "tcp" - cidr_ipv4 = "0.0.0.0/0" -} - -resource "aws_vpc_security_group_egress_rule" "egress" { - for_each = toset(["-1"]) - - security_group_id = aws_security_group.public_access.id - - from_port = each.value - to_port = each.value - ip_protocol = "-1" - cidr_ipv4 = "0.0.0.0/0" -} \ No newline at end of file diff --git a/terraform/output.tf b/terraform/output.tf deleted file mode 100644 index 065b01c..0000000 --- a/terraform/output.tf +++ /dev/null @@ -1,33 +0,0 @@ -output "instance_id" { - value = aws_instance.this.id - description = "The instance ID of the Gitea instance." -} - -output "ip_address" { - value = aws_instance.this.private_ip - description = "The Gitea IP address." -} - -output "boot_region" { - value = var.aws_region - description = "The region to manipulate the codebase repository boot." - sensitive = true -} - -output "boot_id" { - value = module.boot_user.iam_access_key_id - description = "The access id to manipulate the codebase repository boot." - sensitive = true -} - -output "boot_secret" { - value = module.boot_user.iam_access_key_secret - description = "The access secret to manipulate the codebase repository boot." - sensitive = true -} - -output "full_domain" { - value = "${var.subdomain}.${var.domain}" - description = "The domain of the Gitea instance." - sensitive = true -} diff --git a/terraform/outputs.tf b/terraform/outputs.tf new file mode 100644 index 0000000..f2e54d1 --- /dev/null +++ b/terraform/outputs.tf @@ -0,0 +1,11 @@ +output "server_ip" { + description = "The public address of the server." + value = hcloud_server.server_instance.ipv4_address + sensitive = false +} + +output "server_fqdn" { + description = "The public domain of the server." + value = "${local.subdomain}.${local.domain}" + sensitive = false +} diff --git a/terraform/providers.tf b/terraform/providers.tf index d97d5b4..849c70c 100644 --- a/terraform/providers.tf +++ b/terraform/providers.tf @@ -1,11 +1,24 @@ terraform { - # The backend is stored in an S3 bucket. - backend "s3" {} + backend "s3" { + skip_credentials_validation = true + skip_region_validation = true + skip_requesting_account_id = true + } + + required_providers { + hcloud = { + source = "hetznercloud/hcloud" + version = "~> 1.45" + } + } +} + +provider "hcloud" { + token = var.hcloud_token } -# Access AWS through the IaC roles. provider "aws" { region = var.aws_region - access_key = var.aws_access - secret_key = var.aws_secret + access_key = var.aws_access_key + secret_key = var.aws_secret_key } \ No newline at end of file diff --git a/terraform/routing.tf b/terraform/routing.tf index a9bf3df..d1714d1 100644 --- a/terraform/routing.tf +++ b/terraform/routing.tf @@ -1,13 +1,13 @@ # The Route53 DNS zone. data "aws_route53_zone" "main" { - name = var.domain + name = local.domain } # Push all domain traffic through the reverse proxy. resource "aws_route53_record" "domain" { zone_id = data.aws_route53_zone.main.zone_id - name = "${var.subdomain}.${data.aws_route53_zone.main.name}" + name = "${local.subdomain}.${data.aws_route53_zone.main.name}" type = "A" ttl = "60" - records = [aws_eip.public.public_ip] + records = [hcloud_primary_ip.public_ip.ip_address] } \ No newline at end of file diff --git a/terraform/variables.tf b/terraform/variables.tf index 45ee6ed..dd91c42 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,39 +1,39 @@ +locals { + datacenter = "fsn1-dc14" + server_type = "cx22" + server_image = "debian-12" + + domain = "maximhutz.com" + subdomain = "git" +} + +# ---------------------------------------------------------------------------- # + +variable "hcloud_token" { + sensitive = true + description = "The hCloud token used to access Hetzner resources." + type = string +} + +variable "public_ssh_key_path" { + description = "The location of the public key used to access the repository server." + type = string +} + variable "aws_region" { - type = string - description = "The AWS region things are created in." + description = "The region of the AWS account." + type = string + sensitive = true } -variable "aws_access" { - type = string - description = "The access key to generate the Gitea instance." +variable "aws_access_key" { + description = "The access key of the account." + type = string + sensitive = true } -variable "aws_secret" { - type = string - description = "The access secret to generate the Gitea instance." -} - -variable "boot_bucket" { - type = string - description = "The name of the bucket to store the boot in." -} - -variable "boot_key" { - type = string - description = "The path that will hold the boot data." -} - -variable "boot_role" { - type = string - description = "The name of the role for boot access." -} - -variable "domain" { - type = string - description = "The name of the domain." -} - -variable "subdomain" { - type = string - description = "The name of the subdomain." -} +variable "aws_secret_key" { + description = "The secret key of the account." + type = string + sensitive = true +} \ No newline at end of file diff --git a/variables.yml b/variables.yml new file mode 100644 index 0000000..e684b58 --- /dev/null +++ b/variables.yml @@ -0,0 +1,2 @@ +variables: + image_name: mvhutz/gitea diff --git a/vault.yml b/vault.yml new file mode 100644 index 0000000..daff56c --- /dev/null +++ b/vault.yml @@ -0,0 +1,66 @@ +$ANSIBLE_VAULT;1.1;AES256 +62366236383830323331383264663835316237363032333766333730653939666236666261653162 +3938653635393063313566343261303338666363386661650a376637613563303238373965356134 +30373861653832383462666231356163623231303637636539383166383039333562636434646334 +3433393163363562340a333962343636366234336239633032313166303163353165643762326464 +34353062323863666666666132663364633336623430373033623761613035666332323739313833 +38623639643539363639383339356231313431373437343430323237336539313939303139353534 +63616331353464613963323864626663396637313139646461356165643233306530303062666332 +36363636316335356434633439636434336666306466616231353135306538386334313937363765 +34333833626634383734396638646530393233623937396335313637333764313736383032333734 +64373966643030623331663139363034343536373830353338356335356338633638393862386230 +39336533656465366534306465396536613334333632643937316130303338626331386537343331 +64363966323561326262376631356261613231343335393233366231373631663635376234346164 +38303432386336643566363731386664376239666530336232666532616264353537353738636464 +64616364353730653831616335656532663336666339653337646133316661373038326164373235 +30653836336338333932303539393632326164623538303066353934623831376533333964346561 +61323137373837376161653730386637663336623130366639356130626338663764366661616163 +38356235386461366362396337646239633663303261616536386134663866333132613166373162 +33616663316566623665666464356135393932366663663932366235643336343434633731646665 +63323963366662346436393933643032653330313430633339613262306430306332326364343135 +37393764363338656639393333623835626135323434376338656663386662643339643135653938 +37396133373436353566646437633630373931643533383133343266626431393761646633666161 +66313365373537386332396562613531346634376266653631343934356134643463633566373162 +30633933636136663339316136333036386237346163646638393533336362363735623130623862 +38623666383461363564326462326239303838623533393034383831366631396530343037636532 +38366162396663653930633866303538353232656330643966386134316364313538646564313565 +61313732343330336436393963643164303139373036303437393336313738336138306438393364 +65623331663464626462316538663134346231643163356638383631623862313066343965376235 +65613736643163663238316532623638343062633564333865623264356362663433333734383365 +61373432656362343762333561376639396632386530353762303664373733656366343733613262 +62313562323938356563323939316131646239313432626261353431626661613235363566393038 +63656634383230316463363036306433366334643235656561613031653331333038323133653562 +61393034663030663432376331383236626639613663343662323639316331653432383036393130 +35376438333235336461313435316232373963613934323233613431643530646661666135613064 +34313431613164333761643965373939353864333234353136386637326536336266363733343332 +63393539353234343835633639333163386633326163623966343634346265623430326233353734 +61373339393264383038383564346462396362333132346632396534346134613038316231613966 +30636637626531343636376161326434336430386537646333353139353131363461613639646162 +31346538326138366663623439393764653237386564653666396338623435386639623239373438 +31616237343731623634643965386535663939356363653934343362633735353532353662396331 +39373639346336653739613162626537636663376163343831623762643765346535636565376463 +32366361373730376462356332363766376136613562613331386134633264613862383061343462 +38316637336437336637393030613933393633666332353533646362663661313930376337396234 +64636162343130326630366261356263363130663439393539363236343461343436316330663265 +32616665366664303038333966373835646130343237646464353362346132653331303634643165 +31393530373464653066643435343137313937326633653136623462363330343932383939626538 +61663137623931353166616639636635616232306161643432623563643633333739646336356236 +30663463303362396331396630623063646365373839333837333832643231396130636461636537 +35653937363434393331303065326137373931633231323861666632393762353162313635393830 +32666366376638383632666130353438316231313763323833663836663262646135633763376334 +64636531653937303136373063336430303536316636343835396532383164623539653966343865 +64316236656164653936613139643061323264333861623833383061386362333934373535633565 +37623065636437626165646261343265613234373963386134616632396433376162306432633038 +37356135663862363930303834303166333236643864383166333365313131333438373633653631 +35613639343638356135356537626231663661623364313837393065363031616661613032306462 +32653664373334636561613132336631613561363638666465393930336533333962383062316231 +35633535643836323131656337366139313864343632616266363666646130316532336465633562 +35326562633539386238613834656665306365643466356235326536383065623239653235653236 +34356636623263343932336266336664303362613537666630343935313362666466393134653262 +66396561363463646237363638336539663261626534363531636330386136623463366432313335 +36343236613863383139353461313562303534613166353866636262623866383736303262626438 +39353762303831353238323538626635393365363132646563626535613362326662653631663935 +35636134343266626162316135316533346331663634366630633437363531313732313161306665 +35336336323438613865396363363434663461646238346565336233363738666437323235336365 +37316561386137353338643561656262336336373736393939363039663731343636366435633162 +38383564663438303964643563613338306363623831613432333439386165303965